Vulmon
Amazon Linux 2022 Security Advisory: ALAS-2022-149
Advisory Release Date: 2022-10-03 21:26 Pacific
Advisory Updated Date: 2022-10-13 18:48 Pacific
A flaw was found in Subversion. When using path-based authorization (authz), the helper function detect_changed() does not omit potentially sensitive information from log messages. In particular, if a node is copied from a protected location, its copyfrom path (the path to the protected location) is reported even when omission should occur. (CVE-2021-28544)
A use-after-free vulnerability was found in Subversion in the mod_dav_svn Apache HTTP server (HTTPd) module. While looking up path-based authorization (authz) rules, multiple calls to the post_config hook can invalidate cached pointers to object-pools, which Subversion subsequently uses. This issue crashes the single HTTPd worker thread or the entire HTTPd server process, depending on the configuration of the Apache HTTPd server. (CVE-2022-24070)
Affected Packages:
subversion
Issue Correction:
Run dnf update subversion --releasever=2022.0.20221012 to update your system.
aarch64:
subversion-1.14.2-5.amzn2022.0.1.aarch64
python3-subversion-debuginfo-1.14.2-5.amzn2022.0.1.aarch64
subversion-tools-1.14.2-5.amzn2022.0.1.aarch64
subversion-tools-debuginfo-1.14.2-5.amzn2022.0.1.aarch64
subversion-devel-1.14.2-5.amzn2022.0.1.aarch64
subversion-devel-debuginfo-1.14.2-5.amzn2022.0.1.aarch64
subversion-perl-debuginfo-1.14.2-5.amzn2022.0.1.aarch64
python3-subversion-1.14.2-5.amzn2022.0.1.aarch64
subversion-debugsource-1.14.2-5.amzn2022.0.1.aarch64
subversion-perl-1.14.2-5.amzn2022.0.1.aarch64
subversion-libs-1.14.2-5.amzn2022.0.1.aarch64
subversion-libs-debuginfo-1.14.2-5.amzn2022.0.1.aarch64
subversion-debuginfo-1.14.2-5.amzn2022.0.1.aarch64
i686:
subversion-libs-debuginfo-1.14.2-5.amzn2022.0.1.i686
subversion-perl-debuginfo-1.14.2-5.amzn2022.0.1.i686
python3-subversion-1.14.2-5.amzn2022.0.1.i686
subversion-debugsource-1.14.2-5.amzn2022.0.1.i686
subversion-perl-1.14.2-5.amzn2022.0.1.i686
subversion-1.14.2-5.amzn2022.0.1.i686
subversion-libs-1.14.2-5.amzn2022.0.1.i686
python3-subversion-debuginfo-1.14.2-5.amzn2022.0.1.i686
subversion-debuginfo-1.14.2-5.amzn2022.0.1.i686
subversion-devel-1.14.2-5.amzn2022.0.1.i686
subversion-tools-debuginfo-1.14.2-5.amzn2022.0.1.i686
subversion-tools-1.14.2-5.amzn2022.0.1.i686
subversion-devel-debuginfo-1.14.2-5.amzn2022.0.1.i686
noarch:
subversion-javahl-1.14.2-5.amzn2022.0.1.noarch
src:
subversion-1.14.2-5.amzn2022.0.1.src
x86_64:
subversion-devel-debuginfo-1.14.2-5.amzn2022.0.1.x86_64
subversion-1.14.2-5.amzn2022.0.1.x86_64
subversion-perl-debuginfo-1.14.2-5.amzn2022.0.1.x86_64
subversion-tools-1.14.2-5.amzn2022.0.1.x86_64
python3-subversion-1.14.2-5.amzn2022.0.1.x86_64
subversion-tools-debuginfo-1.14.2-5.amzn2022.0.1.x86_64
python3-subversion-debuginfo-1.14.2-5.amzn2022.0.1.x86_64
subversion-libs-debuginfo-1.14.2-5.amzn2022.0.1.x86_64
subversion-debuginfo-1.14.2-5.amzn2022.0.1.x86_64
subversion-devel-1.14.2-5.amzn2022.0.1.x86_64
subversion-libs-1.14.2-5.amzn2022.0.1.x86_64
subversion-debugsource-1.14.2-5.amzn2022.0.1.x86_64
subversion-perl-1.14.2-5.amzn2022.0.1.x86_64